---
title: "Get CSRF token"
method: GET
path: "/csrf-token"
tags: ["Authentication"]
---

# Get CSRF token

`GET /csrf-token`

Retrieve a CSRF token for state-changing requests.
This endpoint must be called before making POST, PUT, or DELETE requests.
The token should be included in the `X-CSRF-Token` header.

## Response `200`

CSRF token generated successfully

- object
  - `done` boolean, required — Indicates if the operation was successful
  - `body` object, nullable, required — Response data (type varies by endpoint, null if no data)
    - `token` string — CSRF token to use in X-CSRF-Token header
  - `title` string, nullable — Optional response title
  - `message` string, nullable — Optional message (error message or success notification)

## Other responses

- `401` — Authentication required

---

[API](https://skmtc.dev/worklenz/apis/worklenz-api.md) · [All operations](https://skmtc.dev/worklenz/apis/worklenz-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/worklenz/worklenz-api/revisions/e44341b9118c/schema)